REMARKS 

Examiner rejected Claims 1-1 1 under 35 U.S.C. §102(e) as being anticipated by U.S. Pat. 
No. 6,684,250 B2 (Anderson). 

Examiner said that the steps of claim 1 were disclosed by Anderson. 

Examiner said that a first step of claim 1 (measuring a network latency from a plurality of 
network stations to a plurality of network endpoints of known physical location by pinging said 
network endpoints from said network stations multiple times over a calibration period) was 
disclosed in Anderson at col. 54, lines 5-18. This cite does not disclose the first step of claim 1. 
In addition, this cite mentions steps that are not included in claim 1 (i.e., confidence factor, 
translation process, generate resolution indication, whether or not traces are going in the same 
direction, determining the number or traces, obtaining variances in distance, determining a circle 
around a predicted point, finding the intersection of circles, determining a distance scale and 
variances). 

Examiner said that a second step of claim 1 (determining round-trip propagation times 
between each of said network stations and each of said network endpoints over the calibration 
period from said pinging and setting the network latency for each combination of said network 
stations and said network endpoints to the corresponding minimum round-trip propagation time 
determined for each of said combination of said network stations and said network endpoints) 
was disclosed in the Abstract and at col. 4, line 23-col. 5, line 50. Nowhere in these cites is 
disclosed that round-trip propagation times between network stations and network endpoints are 
determined, where corresponding minimum round-trip propagation times are used as latency 
periods between the same. Furthermore, these cites include steps not included in Applicants 



invention (i.e., attach a confidence factor to each of the plurality of geographic locations; 
selecting an estimated geographic location as being a best estimate of a true geographic location 
of the network address based on a degree of confidence-factor weighted agreement; using a Last 
Known Host, a Next Known Host, a combination of a Next Known Host and a Last Known Host, 
or at least one suffix of a host name to generate a geographic location; using a confidence map, a 
hop ratio, a string length, a number of geographic locations generated by the at least one 
geographic location operation, a population value, a distance to a Last Known Host, a number of 
hops between a Last Known Host and the at least one geographic location, a minimum 
population of the at least one geographic location and a Last Known Host, a minimum 
connectivity index of the at least one geographic location and a Last Known Host, a distance to a 
Next Known Host from the at least one geographic location, a hop ratio indicating a relative 
position of a Next Known Host within a traceroute against the network address, a distance 
between a Next Known Host and the at least one geographic location, a number of hops between 
a Next Known Host and the at least one geographic location within a traceroute against the 
network address, a minimum population of a Next Known Host and the at least one geographic 
location, a minimum connectivity index between the at least one geographic location and a Next 
Known Host, a mean of connectivity indices for a Last Known Host and address, a position of a 
first character of a word indicative of the at least one geographic location within a host name, or 
a number of network addresses within a registered block of network addresses; using a divide- 
and-conquer blocking algorithm; identifying a common geographic location associated with each 
of the subject and the test network addresses; identifying a substantially common traceroute 
generated responsive to traceroute operations performed against each of the subject and test 
network addresses; determining whether the subject and test network addresses utilizing a 



common DNS server; using a netmask blocking algorithm that utilizes a netmask associated 
with a subject network address; using a topology map; and using respective start and end 
network addresses). 

Examiner said that a third step of claim 1 (measuring the network latency from each of 
said network stations to said network equipment by pinging said network equipment from said 
network stations, determining the minimum round-trip propagation time between each of said 
network stations and said network equipment, and setting the network latency between each of 
said network stations and said network equipment to the corresponding minimum round-trip 
propagation time determined) was disclosed in the Abstract; at col. 4, line 23-col. 5, line 50; and 
at col. 25, lines 1-67. Nowhere in these cites is disclosed the step of measuring the network 
latency from each of said network stations to said network equipment by pinging said network 
equipment from said network stations, determining the minimum round-trip propagation time 
between each of said network stations and said network equipment, and setting the network 
latency between each of said network stations and said network equipment to the corresponding 
minimum round-trip propagation time determined. Furthermore, these cites include steps not 
included in Applicants invention (i.e., attach a confidence factor to each of the plurality of 
geographic locations; selecting an estimated geographic location as being a best estimate of a 
true geographic location of the network address based on a degree of confidence-factor weighted 
agreement; using a Last Known Host, a Next Known Host, a combination of a Next Known Host 
and a Last Known Host, or at least one suffix of a host name to generate a geographic location; 
using a confidence map, a hop ratio, a string length, a number of geographic locations generated 
by the at least one geographic location operation, a population value, a distance to a Last Known 
Host, a number of hops between a Last Known Host and the at least one geographic location, a 



minimum population of the at least one geographic location and a Last Known Host, a minimum 
connectivity index of the at least one geographic location and a Last Known Host, a distance to a 
Next Known Host from the at least one geographic location, a hop ratio indicating a relative 
position of a Next Known Host within a traceroute against the network address, a distance 
between a Next Known Host and the at least one geographic location, a number of hops between 
a Next Known Host and the at least one geographic location within a traceroute against the 
network address, a minimum population of a Next Known Host and the at least one geographic 
location, a minimum connectivity index between the at least one geographic location and a Next 
Known Host, a mean of connectivity indices for a Last Known Host and address, a position of a 
first character of a word indicative of the at least one geographic location within a host name, or 
a number of network addresses within a registered block of network addresses; using a divide- 
and-conquer blocking algorithm; identifying a common geographic location associated with each 
of the subject and the test network addresses; identifying a substantially common traceroute 
generated responsive to traceroute operations performed against each of the subject and test 
network addresses; determining whether the subject and test network addresses utilizing a 
common DNS server; using a netmask blocking algorithm that utilizes a netmask associated 
with a subject network address; using a topology map; and using respective start and end 
network addresses; using a location synthesis process to search for similarities among location 
determinants and building a confirmation table; building location probability table (LPT); 
developing different values at different levels of geographic resolution; combining constituent 
confidence factor fields to identify a most likely location and an associated probability; 
computing the relationship between post-LSP confidence factors and accuracy; translating the 
location probability table to reflect the actual probability that the given network address was 



correctly located; using location determination modules (LDMs), confidence maps (CMs), 
confidence factors (CFs); using a location filter 122; using nine location determination modules, 
RegEx LDM 130 that uses string pattern matching in a hostname, Net LDM 132 that uses an IP 
Registry, DNS LDM 134 that uses a Domain Name Service Registry, ASN LDM 136 that uses 
an Autonomous System Registry, Loc LDM 138 that uses a DNS Loc Record, LKH LDM 140 
that uses a Last Known Host in a Traceroute, NKH LDM 142 that uses a Next Known Host in a 
Traceroute, Sandwich LDM 144 that uses a combination of LKH and NKH, and Suffix LDM 
146 that uses the last one or two words of a hostname). 

Examiner said that a fourth step of claim 1 (for each of said network endpoints arranging 
the network latency from the network endpoint to each of said network stations in turn, in a 
particular order, as vector elements in an endpoint vector) was disclosed in the Abstract; at col. 4, 
line 23-col. 5, line 50; and col 25, lines 1-67. Nowhere in these cites is disclosed the step of for 
each of said network endpoints arranging the network latency from the network endpoint to each 
of said network stations in turn, in a particular order, as vector elements in an endpoint vector. 
Furthermore, these cites include steps not included in Applicants invention (i.e., attach a 
confidence factor to each of the plurality of geographic locations; selecting an estimated 
geographic location as being a best estimate of a true geographic location of the network address 
based on a degree of confidence- factor weighted agreement; using a Last Known Host, a Next 
Known Host, a combination of a Next Known Host and a Last Known Host, or at least one suffix 
of a host name to generate a geographic location; using a confidence map, a hop ratio, a string 
length, a number of geographic locations generated by the at least one geographic location 
operation, a population value, a distance to a Last Known Host, a number of hops between a Last 
Known Host and the at least one geographic location, a minimum population of the at least one 



geographic location and a Last Known Host, a minimum connectivity index of the at least one 
geographic location and a Last Known Host, a distance to a Next Known Host from the at least 
one geographic location, a hop ratio indicating a relative position of a Next Known Host within a 
traceroute against the network address, a distance between a Next Known Host and the at least 
one geographic location, a number of hops between a Next Known Host and the at least one 
geographic location within a traceroute against the network address, a minimum population of a 
Next Known Host and the at least one geographic location, a minimum connectivity index 
between the at least one geographic location and a Next Known Host, a mean of connectivity 
indices for a Last Known Host and address, a position of a first character of a word indicative of 
the at least one geographic location within a host name, or a number of network addresses within 
a registered block of network addresses; using a divide-and-conquer blocking algorithm; 
identifying a common geographic location associated with each of the subject and the test 
network addresses; identifying a substantially common traceroute generated responsive to 
traceroute operations performed against each of the subject and test network addresses; 
determining whether the subject and test network addresses utilizing a common DNS server; 
using a netmask blocking algorithm that utilizes a netmask associated with a subject network 
address; using a topology map; and using respective start and end network addresses; using a 
location synthesis process to search for similarities among location determinants and building a 
confirmation table; building location probability table (LPT); developing different values at 
different levels of geographic resolution; combining constituent confidence factor fields to 
identify a most likely location and an associated probability; computing the relationship between 
post-LSP confidence factors and accuracy; translating the location probability table to reflect the 
actual probability that the given network address was correctly located; using location 



determination modules (LDMs), confidence maps (CMs), confidence factors (CFs); using a 
location filter 122; using nine location determination modules, RegEx LDM 130 that uses string 
pattern matching in a hostname, Net LDM 132 that uses an IP Registry, DNS LDM 134 that uses 
a Domain Name Service Registry, ASN LDM 136 that uses an Autonomous System Registry, 
Loc LDM 138 that uses a DNS Loc Record, LKH LDM 140 that uses a Last Known Host in a 
Traceroute, NKH LDM 142 that uses a Next Known Host in a Traceroute, Sandwich LDM 144 
that uses a combination of LKH and NKH, and Suffix LDM 146 that uses the last one or two 
words of a hostname). 

Examiner said that a fifth step of claim 1 (arranging the network latency from said 
network equipment to each of said network station in turn, in said particular order, as vector 
elements in a network equipment vector) was disclosed in the Abstract; at col. 4, line 23-col. 5, 
line 50; col 25, lines 1-67; and col. 53, line 32-col. 54, line 18. Nowhere in these cites are 
disclosed the step of arranging the network latency from said network equipment to each of said 
network station in turn, in said particular order, as vector elements in a network equipment 
vector. Furthermore, the cites include steps not found in claim 1 (i.e., attach a confidence factor 
to each of the plurality of geographic locations; selecting an estimated geographic location as 
being a best estimate of a true geographic location of the network address based on a degree of 
confidence-factor weighted agreement; using a Last Known Host, a Next Known Host, a 
combination of a Next Known Host and a Last Known Host, or at least one suffix of a host name 
to generate a geographic location; using a confidence map, a hop ratio, a string length, a number 
of geographic locations generated by the at least one geographic location operation, a population 
value, a distance to a Last Known Host, a number of hops between a Last Known Host and the at 
least one geographic location, a minimum population of the at least one geographic location and 



a Last Known Host, a minimum connectivity index of the at least one geographic location and a 
Last Known Host, a distance to a Next Known Host from the at least one geographic location, a 
hop ratio indicating a relative position of a Next Known Host within a traceroute against the 
network address, a distance between a Next Known Host and the at least one geographic 
location, a number of hops between a Next Known Host and the at least one geographic location 
within a traceroute against the network address, a minimum population of a Next Known Host 
and the at least one geographic location, a minimum connectivity index between the at least one 
geographic location and a Next Known Host, a mean of connectivity indices for a Last Known 
Host and address, a position of a first character of a word indicative of the at least one geographic 
location within a host name, or a number of network addresses within a registered block of 
network addresses; using a divide-and-conquer blocking algorithm; identifying a common 
geographic location associated with each of the subject and the test network addresses; 
identifying a substantially common traceroute generated responsive to traceroute operations 
performed against each of the subject and test network addresses; determining whether the 
subject and test network addresses utilizing a common DNS server; using a netmask blocking 
algorithm that utilizes a netmask associated with a subject network address; using a topology 
map; and using respective start and end network addresses; using a location synthesis process to 
search for similarities among location determinants and building a confirmation table; building 
location probability table (LPT); developing different values at different levels of geographic 
resolution; combining constituent confidence factor fields to identify a most likely location and 
an associated probability; computing the relationship between post-LSP confidence factors and 
accuracy; translating the location probability table to reflect the actual probability that the given 
network address was correctly located; using location determination modules (LDMs), 



confidence maps (CMs), confidence factors (CFs); using a location filter 122; using nine location 
determination modules, RegEx LDM 130 that uses string pattern matching in a hostname, Net 
LDM 132 that uses an IP Registry, DNS LDM 134 that uses a Domain Name Service Registry, 
ASN LDM 136 that uses an Autonomous System Registry, Loc LDM 138 that uses a DNS Loc 
Record, LKH LDM 140 that uses* a Last Known Host in a Traceroute, NKH LDM 142 that uses a 
Next Known Host in a Traceroute, Sandwich LDM 144 that uses a combination of LKH and 
NKH, and Suffix LDM 146 that uses the last one or two words of a hostname; using 
triangulation; extrapolating a general direction from the traceroutes; inferring direction by 
subtracting geographical locations of the originating network address from those of the latest 
router in the trace; using the number of hops to estimate distance; making "rsh" calls to obtain 
traceroutes; and generating a resolution indication using direction, number of traces, and 
variances in distances). 

Examiner said that a sixth step of claim 1 (determining a distance between the network 
equipment vector and each of the endpoint vectors) was disclosed in the Abstract; at col. 4, line 
23-col. 5, line 50; col. 25, lines 1-67; col. 53, line 32-col. 54, line 18, and col. 34, line 61-col.35, 
line 16. Nowhere in these cites are disclosed the step of determining a distance between the 
network equipment vector and each of the endpoint vectors. Furthermore, the cites include steps 
not found in claim 1 (i.e., attach a confidence factor to each of the plurality of geographic 
locations; selecting an estimated geographic location as being a best estimate of a true 
geographic location of the network address based on a degree of confidence-factor weighted 
agreement; using a Last Known Host, a Next Known Host, a combination of a Next Known Host 
and a Last Known Host, or at least one suffix of a host name to generate a geographic location; 
using a confidence map, a hop ratio, a string length, a number of geographic locations generated 



by the at least one geographic location operation, a population value, a distance to a Last Known 
Host, a number of hops between a Last Known Host and the at least one geographic location, a 
minimum population of the at least one geographic location and a Last Known Host, a minimum 
connectivity index of the at least one geographic location and a Last Known Host, a distance to a 
Next Known Host from the at least one geographic location, a hop ratio indicating a relative 
position of a Next Known Host within a traceroute against the network address, a distance 
between a Next Known Host and the at least one geographic location, a number of hops between 
a Next Known Host and the at least one geographic location within a traceroute against the 
network address, a minimum population of a Next Known Host and the at least one geographic 
location, a minimum connectivity index between the at least one geographic location and a Next 
Known Host, a mean of connectivity indices for a Last Known Host and address, a position of a 
first character of a word indicative of the at least one geographic location within a host name, or 
a number of network addresses within a registered block of network addresses; using a divide- 
and-conquer blocking algorithm; identifying a common geographic location associated with each 
of the subject and the test network addresses; identifying a substantially common traceroute 
generated responsive to traceroute operations performed against each of the subject and test 
network addresses; determining whether the subject and test network addresses utilizing a 
common DNS server; using a netmask blocking algorithm that utilizes a netmask associated 
with a subject network address; using a topology map; and using respective start and end 
network addresses; using a location synthesis process to search for similarities among location 
determinants and building a confirmation table; building location probability table (LPT); 
developing different values at different levels of geographic resolution; combining constituent 
confidence factor fields to identify a most likely location and an associated probability; 



computing the relationship between post-LSP confidence factors and accuracy; translating the 
location probability table to reflect the actual probability that the given network address was 
correctly located; using location determination modules (LDMs), confidence maps (CMs), 
confidence factors (CFs); using a location filter 122; using nine location determination modules, 
RegEx LDM 130 that uses string pattern matching in a hostname, Net LDM 132 that uses an IP 
Registry, DNS LDM 134 that uses a Domain Name Service Registry, ASN LDM 136 that uses 
an Autonomous System Registry, Loc LDM 138 that uses a DNS Loc Record, LKH LDM 140 
that uses a Last Known Host in a Traceroute, NKH LDM 142 that uses a Next Known Host in a 
Traceroute, Sandwich LDM 144 that uses a combination of LKH and NKH, and Suffix LDM 
146 that uses the last one or two words of a hostname; using triangulation; extrapolating a 
general direction from the traceroutes; inferring direction by subtracting geographical locations 
of the originating network address from those of the latest router in the trace; using the number 
of hops to estimate distance; making "rsh" calls to obtain traceroutes; and generating a resolution 
indication using direction, number of traces, and variances in distances). 

Examiner said that a seventh step of claim 1 (identifying the physical location of the 
network equipment as proximate to said known physical location of the network endpoint 
corresponding to the endpoint vector having said distance to the network equipment vector not 
greater than the distance from any other of the endpoint vectors to the target equipment vector) 
was disclosed in the Abstract; at col. 4, line 23-col. 5, line 50; col. 25, lines 1-67; col. 45, lines 
10-29; and col. 53, line 32-col. 54, line 18. Nowhere in these cites are disclosed the step of 
determining a distance between the network equipment vector and each of the endpoint vectors. 
Furthermore, the cites include steps not found in claim 1 (i.e., attach a confidence factor to each 
of the plurality of geographic locations; selecting an estimated geographic location as being a 



best estimate of a true geographic location of the network address based on a degree of 
confidence-factor weighted agreement; using a Last Known Host, a Next Known Host, a 
combination of a Next Known Host and a Last Known Host, or at least one suffix of a host name 
to generate a geographic location; using a confidence map, a hop ratio, a string length, a number 
of geographic locations generated by the at least one geographic location operation, a population 
value, a distance to a Last Known Host, a number of hops between a Last Known Host and the at 
least one geographic location, a minimum population of the at least one geographic location and 
a Last Known Host, a minimum connectivity index of the at least one geographic location and a 
Last Known Host, a distance to a Next Known Host from the at least one geographic location, a 
hop ratio indicating a relative position of a Next Known Host within a traceroute against the 
network address, a distance between a Next Known Host and the at least one geographic 
location, a number of hops between a Next Known Host and the at least one geographic location 
within a traceroute against the network address, a minimum population of a Next Known Host 
and the at least one geographic location, a minimum connectivity index between the at least one 
geographic location and a Next Known Host, a mean of connectivity indices for a Last Known 
Host and address, a position of a first character of a word indicative of the at least one geographic 
location within a host name, or a number of network addresses within a registered block of 
network addresses; using a divide-and-conquer blocking algorithm; identifying a common 
geographic location associated with each of the subject and the test network addresses; 
identifying a substantially common traceroute generated responsive to traceroute operations 
performed against each of the subject and test network addresses; determining whether the 
subject and test network addresses utilizing a common DNS server; using a netmask blocking 
algorithm that utilizes a netmask associated with a subject network address; using a topology 



map; and using respective start and end network addresses; using a location synthesis process to 
search for similarities among location determinants and building a confirmation table; building 
location probability table (LPT); developing different values at different levels of geographic 
resolution; combining constituent confidence factor fields to identify a most likely location and 
an associated probability; computing the relationship between post-LSP confidence factors and 
accuracy; translating the location probability table to reflect the actual probability that the given 
network address was correctly located; using location determination modules (LDMs), 
confidence maps (CMs), confidence factors (CFs); using a location filter 122; using nine location 
determination modules, RegEx LDM 130 that uses string pattern matching in a hostname, Net 
LDM 132 that uses an IP Registry, DNS LDM 134 that uses a Domain Name Service Registry, 
ASN LDM 136 that uses an Autonomous System Registry, Loc LDM 138 that uses a DNS Loc 
Record, LKH LDM 140 that uses a Last Known Host in a Traceroute, NKH LDM 142 that uses a 
Next Known Host in a Traceroute, Sandwich LDM 144 that uses a combination of LKH and 
NKH, and Suffix LDM 146 that uses the last one or two words of a hostname; using 
triangulation; extrapolating a general direction from the traceroutes; inferring direction by 
subtracting geographical locations of the originating network address from those of the latest 
router in the trace; using the number of hops to estimate distance; making "rsh" calls to obtain 
traceroutes; and generating a resolution indication using direction, number of traces, and 
variances in distances). 

Examiner said that the method of claim 2 (verifying that a geolocation of network 
equipment associated with a logical network address on a communications network is consistent 
with network equipment associated with vetted geolocations) is disclosed in Anderson at col. 22, 
lines 5-13). This cite says that a subnet blocking algorithm verifies every block within two 



traceroutes. Claim 2 does not use a subnet blocking algorithm and does not verify every block 
within two traceroutes. Therefore, this cite does not disclose the method of claim 2. 

Examiner said that a third step of claim 2 (setting the network latency for each 
combination of said network stations and said network equipments associated with vetted 
geolocations to the corresponding minimum round-trip propagation time determined for each of 
said combination of said network stations and said network equipments associated with vetted 
geolocations) was disclosed in Anderson in the Abstract, col. 4, line 23-col. 5, line 50; col. 17, 
line 42-col. 18, line 18; col. 25, lines 1-67; col. 45, lines 10-29; col. 53, line 32-col. 54, line 18. 
Nowhere in these cites are disclosed the step of setting the network latency for each combination 
of said network stations and said network equipments associated with vetted geolocations to the 
corresponding minimum round-trip propagation time determined for each of said combination of 
said network stations and said network equipments associated with vetted geolocations. 
Furthermore, the cites include steps not found in claim 2 (i.e., attach a confidence factor to each 
of the plurality of geographic locations; selecting an estimated geographic location as being a 
best estimate of a true geographic location of the network address based on a degree of 
confidence-factor weighted agreement; using a Last Known Host, a Next Known Host, a 
combination of a Next Known Host and a Last Known Host, or at least one suffix of a host name 
to generate a geographic location; using a confidence map, a hop ratio, a string length, a number 
of geographic locations generated by the at least one geographic location operation, a population 
value, a distance to a Last Known Host, a number of hops between a Last Known Host and the at 
least one geographic location, a minimum population of the at least one geographic location and 
a Last Known Host, a minimum connectivity index of the at least one geographic location and a 
Last Known Host, a distance to a Next Known Host from the at least one geographic location, a 



hop ratio indicating a relative position of a Next Known Host within a traceroute against the 
network address, a distance between a Next Known Host and the at least one geographic 
location, a number of hops between a Next Known Host and the at least one geographic location 
within a traceroute against the network address, a minimum population of a Next Known Host 
and the at least one geographic location, a minimum connectivity index between the at least one 
geographic location and a Next Known Host, a mean of connectivity indices for a Last Known 
Host and address, a position of a first character of a word indicative of the at least one geographic 
location within a host name, or a number of network addresses within a registered block of 
network addresses; using a divide-and-conquer blocking algorithm; identifying a common 
geographic location associated with each of the subject and the test network addresses; 
identifying a substantially common traceroute generated responsive to traceroute operations 
performed against each of the subject and test network addresses; determining whether the 
subject and test network addresses utilizing a common DNS server; using a netmask blocking 
algorithm that utilizes a netmask associated with a subject network address; using a topology 
map; and using respective start and end network addresses; using a location synthesis process to 
search for similarities among location determinants and building a confirmation table; building 
location probability table (LPT); developing different values at different levels of geographic 
resolution; combining constituent confidence factor fields to identify a most likely location and 
an associated probability; computing the relationship between post-LSP confidence factors and 
accuracy; translating the location probability table to reflect the actual probability that the given 
network address was correctly located; using location determination modules (LDMs), 
confidence maps (CMs), confidence factors (CFs); using a location filter 122; using nine location 
determination modules, RegEx LDM 130 that uses string pattern matching in a hostname, Net 



LDM 132 that uses an IP Registry, DNS LDM 134 that uses a Domain Name Service Registry, 
ASN LDM 136 that uses an Autonomous System Registry, Loc LDM 138 that uses a DNS Loc 
Record, LKH LDM 140 that uses a Last Known Host in a Traceroute, NKH LDM 142 that uses a 
Next Known Host in a Traceroute, Sandwich LDM 144 that uses a combination of LKH and 
NKH, Suffix LDM 146 that uses the last one or two words of a hostname; using triangulation; 
extrapolating a general direction from the traceroutes; inferring direction by subtracting 
geographical locations of the originating network address from those of the latest router in the 
trace; using the number of hops to estimate distance; making "rsh" calls to obtain traceroutes; 
and generating a resolution indication using direction, number of traces, and variances in 
distances; rendering geolocation information for neighboring network addresses within a block to 
increase the confidence factor; writing a record into a data warehouse; executing a series of 
inexact geographic location operations; labeling inexact geographic location operations as such; 
executing inexact geolocation operations on a number of network addresses surrounding a 
subject network address; consolidating the outputs of the inexact geolocation operations by a 
unified mapping process; and forwarding negative determinations for manual resolution). 

Examiner said that a fifth step through a ninth step of claim 2 (setting the network latency 
between each of said network stations and said network equipment to the corresponding 
minimum round-trip propagation time determined; for each of said network equipments 
associated with vetted geolocations arranging the network latency from each of said network 
equipments associated with vetted geolocations to each of said network stations in turn, in a 
particular order, as vector elements in a vetted equipment vector; arranging the network latency 
from said network equipment to each of said network stations in turn, in said particular order, as 
vector elements in a network equipment vector; determining a distance between the network 



equipment vector and each of the vetted equipment vectors; and determining if the physical 
location of the network equipment is proximate to one of said network equipments associated 
with vetted geolocations) was disclosed in Anderson in the Abstract, col. 4, line 23-coL 5, line 
50; col.17, line 42-col. 18, line 18; col. 25, lines 1-67; col. 45, lines 10-29; col. 53, line 32-col. 
54, line 18. Nowhere in these cites are disclosed these steps. Furthermore, the cites include steps 
not found in claim 2 (i.e., attach a confidence factor to each of the plurality of geographic 
locations; selecting an estimated geographic location as being a best estimate of a true 
geographic location of the network address based on a degree of confidence-factor weighted 
agreement; using a Last Known Host, a Next Known Host, a combination of a Next Known Host 
and a Last Known Host, or at least one suffix of a host name to generate a geographic location; 
using a confidence map, a hop ratio, a string length, a number of geographic locations generated 
by the at least one geographic location operation, a population value, a distance to a Last Known 
Host, a number of hops between a Last Known Host and the at least one geographic location, a 
minimum population of the at least one geographic location and a Last Known Host, a minimum 
connectivity index of the at least one geographic location and a Last Known Host, a distance to a 
Next Known Host from the at least one geographic location, a hop ratio indicating a relative 
position of a Next Known Host within a traceroute against the network address, a distance 
between a Next Known Host and the at least one geographic location, a number of hops between 
a Next Known Host and the at least one geographic location within a traceroute against the 
network address, a minimum population of a Next Known Host and the at least one geographic 
location, a minimum connectivity index between the at least one geographic location and a Next 
Known Host, a mean of connectivity indices for a Last Known Host and address, a position of a 
first character of a word indicative of the at least one geographic location within a host name, or 



a number of network addresses within a registered block of network addresses; using a divide- 
and-conquer blocking algorithm; identifying a common geographic location associated with each 
of the subject and the test network addresses; identifying a substantially common traceroute 
generated responsive to traceroute operations performed against each of the subject and test 
network addresses; determining whether the subject and test network addresses utilizing a 
common DNS server; using a netmask blocking algorithm that utilizes a netmask associated 
with a subject network address; using a topology map; and using respective start and end 
network addresses; using a location synthesis process to search for similarities among location 
determinants and building a confirmation table; building location probability table (LPT); 
developing different values at different levels of geographic resolution; combining constituent 
confidence factor fields to identify a most likely location and an associated probability; 
computing the relationship between post-LSP confidence factors and accuracy; translating the 
location probability table to reflect the actual probability that the given network address was 
correctly located; using location determination modules (LDMs), confidence maps (CMs), 
confidence factors (CFs); using a location filter 122; using nine location determination modules, 
RegEx LDM 130 that uses string pattern matching in a hostname, Net LDM 132 that uses an IP 
Registry, DNS LDM 134 that uses a Domain Name Service Registry, ASN LDM 136 that uses 
an Autonomous System Registry, Loc LDM 138 that uses a DNS Loc Record, LKH LDM 140 . 
that uses a Last Known Host in a Traceroute, NKH LDM 142 that uses a Next Known Host in a 
Traceroute, Sandwich LDM 144 that uses a combination of LKH and NKH, Suffix LDM 146 
that uses the last one or two words of a hostname; using triangulation; extrapolating a general 
direction from the traceroutes; inferring direction by subtracting geographical locations of the 
originating network address from thos of the latest router in the trace; using the number of hops 



to estimate distance; making "rsh" calls to obtain traceroutes; and generating a resolution 
indication using direction, number of traces, and variances in distances; rendering geolocation 
information for neighboring network addresses within a block to increase the confidence factor; 
writing a record into a data warehouse; executing a series of inexact geographic location 
operations; labeling inexact geographic location operations as such; executing inexact 
geolocation operations on a number of network addresses surrounding a subject network address; 
consolidating the outputs of the inexact geolocation operations by a unified mapping process; 
and forwarding negative determinations for manual resolution). 

Examiner said that claim 3 (the method of claim 1 further comprising the step of 
determining if said distance to the network equipment vector not greater than the distance from 
any other of the endpoint vectors to the target equipment is within a user defined threshold) was 
disclosed in Anderson in the Abstract, col. 4, line 23-col. 5, line 50; col. 17, line 42-col. 18, line 
18; col. 25, lines 1-67; col. 45, lines 10-29; col. 53, line 32-col 54, line 18; and col. 21, line 15- 
col. 22, line 13. Nowhere in these cites are disclosed the steps of claim 1 and claim 3. 
Furthermore, the cites include steps not found in claim 3 (i.e., attach a confidence factor to each 
of the plurality of geographic locations; selecting an estimated geographic location as being a 
best estimate of a true geographic location of the network address based on a degree of 
confidence-factor weighted agreement; using a Last Known Host, a Next Known Host, a 
combination of a Next Known Host and a Last Known Host, or at least one suffix of a host name 
to generate a geographic location; using a confidence map, a hop ratio, a string length, a number 
of geographic locations generated by the at least one geographic location operation, a population 
value, a distance to a Last Known Host, a number of hops between a Last Known Host and the at 
least one geographic location, a minimum population of the at least one geographic location and 



a Last Known Host, a minimum connectivity index of the at least one geographic location and a 
Last Known Host, a distance to a Next Known Host from the at least one geographic location, a 
hop ratio indicating a relative position of a Next Known Host within a traceroute against the 
network address, a distance between a Next Known Host and the at least one geographic 
location, a number of hops between a Next Known Host and the at least one geographic location 
within a traceroute against the network address, a minimum population of a Next Known Host 
and the at least one geographic location, a minimum connectivity index between the at least one 
geographic location and a Next Known Host, a mean of connectivity indices for a Last Known 
Host and address, a position of a first character of a word indicative of the at least one geographic 
location within a host name, or a number of network addresses within a registered block of 
network addresses; using a divide-and-conquer blocking algorithm; identifying a common 
geographic location associated with each of the subject and the test network addresses; 
identifying a substantially common traceroute generated responsive to traceroute operations 
performed against each of the subject and test network addresses; determining whether the 
subject and test network addresses utilizing a common DNS server; using a netmask blocking 
algorithm that utilizes a netmask associated with a subject network address; using a topology 
map; and using respective start and end network addresses; using a location synthesis process to 
search for similarities among location determinants and building a confirmation table; building 
location probability table (LPT); developing different values at different levels of geographic 
resolution; combining constituent confidence factor fields to identify a most likely location and 
an associated probability; computing the relationship between post-LSP confidence factors and 
accuracy; translating the location probability table to reflect the actual probability that the given 
network address was correctly located; using location determination modules (LDMs), 



confidence maps (CMs), confidence factors (CFs); using a location filter 122; using nine location 
determination modules, RegEx LDM 130 that uses string pattern matching in a hostname, Net 
LDM 132 that uses an IP Registry, DNS LDM 134 that uses a Domain Name Service Registry, 
ASN LDM 136 that uses an Autonomous System Registry, Loc LDM 138 that uses a DNS Loc 
Record, LKH LDM 140 that uses a Last Known Host in a Traceroute, NKH LDM 142 that uses a 
Next Known Host in a Traceroute, Sandwich LDM 144 that uses a combination of LKH and 
NKH, Suffix LDM 146 that uses the last one or two words of a hostname; using triangulation; 
extrapolating a general direction from the traceroutes; inferring direction by subtracting 
geographical locations of the originating network address from those of the latest router in the 
trace; using the number of hops to estimate distance; making "rsh" calls to obtain traceroutes; 
and generating a resolution indication using direction, number of traces, and variances in 
distances; rendering geolocation information for neighboring network addresses within a block to 
increase the confidence factor; writing a record into a data warehouse; executing a series of 
inexact geographic location operations; labeling inexact geographic location operations as such; 
executing inexact geolocation operations on a number of network addresses surrounding a 
subject network address; consolidating the outputs of the inexact geolocation operations by a 
unified mapping process; forwarding negative determinations for manual resolution; examining 
next-to-last hop in traceroute; looking one hop back; start looking for hosts at the high end; using 
a divide-and-conquer method of selective pinging; determining whether an end node traceroute is 
the same as the next-to-last hop traceroute; and looking for patterns in the last three hops). 

Examiner said that claim 4 (where some steps of claim 3 are repeated until a distance is 
within a user-definable threshold) was disclosed in Anderson in the Abstract, col. 4, line 23-col. 
5, line 50; col. 17, line42-col. 18, line 18; col. 25, lines 1-67; col. 45, lines 10-29; col. 53, line 



32-col. 54, line 18; and col. 21, line 15-col. 22, line 13. Nowhere in these cites are disclosed the 
steps of claim 3 and claim 4. Furthermore, the cites include steps not found in claim 4 (i.e., attach 
a confidence factor to each of the plurality of geographic locations; selecting an estimated 
geographic location as being a best estimate of a true geographic location of the network address 
based on a degree of confidence-factor weighted agreement; using a Last Known Host, a Next 
Known Host, a combination of a Next Known Host and a Last Known Host, or at least one suffix 
of a host name to generate a geographic location; using a confidence map, a hop ratio, a string 
length, a number of geographic locations generated by the at least one geographic location 
operation, a population value, a distance to a Last Known Host, a number of hops between a Last 
Known Host and the at least one geographic location, a minimum population of the at least one 
geographic location and a Last Known Host, a minimum connectivity index of the at least one 
geographic location and a Last Known Host, a distance to a Next Known Host from the at least 
one geographic location, a hop ratio indicating a relative position of a Next Known Host within a 
traceroute against the network address, a distance between a Next Known Host and the at least 
one geographic location, a number of hops between a Next Known Host and the at least one 
geographic location within a traceroute against the network address, a minimum population of a 
Next Known Host and the at least one geographic location, a minimum connectivity index 
between the at least one geographic location and a Next Known Host, a mean of connectivity 
indices for a Last Known Host and address, a position of a first character of a word indicative of 
the at least one geographic location within a host name, or a number of network addresses within 
a registered block of network addresses; using a divide-and-conquer blocking algorithm; 
identifying a common geographic location associated with each of the subject and the test 
network addresses; identifying a substantially common traceroute generated responsive to 



traceroute operations performed against each of the subject and test network addresses; 
determining whether the subject and test network addresses utilizing a common DNS server; 
using a netmask blocking algorithm that utilizes a netmask associated with a subject network 
address; using a topology map; and using respective start and end network addresses; using a 
location synthesis process to search for similarities among location determinants and building a 
confirmation table; building location probability table (LPT); developing different values at 
different levels of geographic resolution; combining constituent confidence factor fields to 
identify a most likely location and an associated probability; computing the relationship between 
post-LSP confidence factors and accuracy; translating the location probability table to reflect the 
actual probability that the given network address was correctly located; using location 
determination modules (LDMs), confidence maps (CMs), confidence factors (CFs); using a 
location filter 122; using nine location determination modules, RegEx LDM 130 that uses string 
pattern matching in a hostname, Net LDM 132 that uses an IP Registry, DNS LDM 134 that uses 
a Domain Name Service Registry, ASN LDM 136 that uses an Autonomous System Registry, 
Loc LDM 138 that uses a DNS Loc Record, LKH LDM 140 that uses a Last Known Host in a 
Traceroute, NKH LDM 142 that uses a Next Known Host in a Traceroute, Sandwich LDM 144 
that uses a combination of LKH and NKH, Suffix LDM 146 that uses the last one or two words 
of a hostname; using triangulation; extrapolating a general direction from the traceroutes; 
inferring direction by subtracting geographical locations of the originating network address from 
those of the latest router in the trace; using the number of hops to estimate distance; making 
"rsh" calls to obtain traceroutes; and generating a resolution indication using direction, number 
of traces, and variances in distances; rendering geolocation information for neighboring network 
addresses within a block to increase the confidence factor; writing a record into a data 



warehouse; executing a series of inexact geographic location operations; labeling inexact 
geographic location operations as such; executing inexact geolocation operations on a number of 
network addresses surrounding a subject network address; consolidating the outputs of the 
inexact geolocation operations by a unified mapping process; forwarding negative determinations 
for manual resolution; examining next-to-last hop in traceroute; looking one hop back; start 
looking for hosts at the high end; using a divide-and-conquer method of selective pinging; 
determining whether an end node traceroute is the same as the next-to-last hop traceroute; and 
looking for patterns in the last three hops). 

Examiner said that claim 5 (where some steps of claim 3 are repeated until a distance is 
within a user-definable threshold using a different set of network endpoints) was disclosed in 
Anderson in the Abstract, col. 4, line 23-col. 5, line 50; col.17, line 42-col. 18, line 18; col. 25, 
lines 1-67; col. 45, lines 10-29; col. 53, line 32-col. 54, line 18; and col. 21, line 15-col. 22, line 
13. Nowhere in these cites are disclosed the steps of claim 3 and claim 5. Furthermore, the cites 
include steps not found in claim 5 (i.e., attach a confidence factor to each of the plurality of 
geographic locations; selecting an estimated geographic location as being a best estimate of a 
true geographic location of the network address based on a degree of confidence-factor weighted 
agreement; using a Last Known Host, a Next Known Host, a combination of a Next Known Host 
and a Last Known Host, or at least one suffix of a host name to generate a geographic location; 
using a confidence map, a hop ratio, a string length, a number of geographic locations generated 
by the at least one geographic location operation, a population value, a distance to a Last Known 
Host, a number of hops between a Last Known Host and the at least one geographic location, a 
minimum population of the at least one geographic location and a Last Known Host, a minimum 
connectivity index of the at least one geographic location and a Last Known Host, a distance to a 



Next Known Host from the at least one geographic location, a hop ratio indicating a relative 
position of a Next Known Host within a traceroute against the network address, a distance 
between a Next Known Host and the at least one geographic location, a number of hops between 
a Next Known Host and the at least one geographic location within a traceroute against the 
network address, a minimum population of a Next Known Host and the at least one geographic 
location, a minimum connectivity index between the at least one geographic location and a Next 
Known Host, a mean of connectivity indices for a Last Known Host and address, a position of a 
first character of a word indicative of the at least one geographic location within a host name, or 
a number of network addresses within a registered block of network addresses; using a divide- 
and-conquer blocking algorithm; identifying a common geographic location associated with each 
of the subject and the test network addresses; identifying a substantially common traceroute 
generated responsive to traceroute operations performed against each of the subject and test 
network addresses; determining whether the subject and test network addresses utilizing a 
common DNS server; using a netmask blocking algorithm that utilizes a netmask associated 
with a subject network address; using a topology map; and using respective start and end 
network addresses; using a location synthesis process to search for similarities among location 
determinants and building a confirmation table; building location probability table (LPT); 
developing different values at different levels of geographic resolution; combining constituent 
confidence factor fields to identify a most likely location and an associated probability; 
computing the relationship between post-LSP confidence factors and accuracy; translating the 
location probability table to reflect the actual probability that the given network address was 
correctly located; using location determination modules (LDMs), confidence maps (CMs), 
confidence factors (CFs); using a location filter 122; using nine location determination modules, 



RegEx LDM 130 that uses string pattern matching in a hostname, Net LDM 132 that uses an BP 
Registry, DNS LDM 134 that uses a Domain Name Service Registry, ASN LDM 136 that uses 
an Autonomous System Registry, Loc LDM 138 that uses a DNS Loc Record, LKH LDM 140 
that uses a Last Known Host in a Traceroute, NKH LDM 142 that uses a Next Known Host in a 
Traceroute, Sandwich LDM 144 that uses a combination of LKH and NKH, Suffix LDM 146 
that uses the last one or two words of a hostname; using triangulation; extrapolating a general 
direction from the traceroutes; inferring direction by subtracting geographical locations of the 
originating network address from those of the latest router in the trace; using the number of hops 
to estimate distance; making "rsh" calls to obtain traceroutes; and generating a resolution 
indication using direction, number of traces, and variances in distances; rendering geolocation 
information for neighboring network addresses within a block to increase the confidence factor; 
writting a record into a data warehouse; executing a series of inexact geographic location 
operations; labeling inexact geographic location operations as such; executing inexact 
geolocation operations on a number of network addresses surrounding a subject network address; 
consolidating the outputs of the inexact geolocation operations by a unified mapping process; 
forwarding negative determinations for manual resolution; examining next-to-last hop in 
traceroute; looking one hop back; start looking for hosts at the high end; using a divide-and- 
conquer method of selective pinging; determining whether an end node traceroute is the same as 
the next-to-last hop traceroute; and looking for patterns in the last three hops). 

Examiner said that claim 6 (where some steps of claim 3 are repeated until a distance is 
within a user-definable threshold) was disclosed in Anderson in the Abstract, col. 4, line 23-col. 
5, line 50; col.17, line 42-col. 18, line 18; col. 25, lines 1-67; col. 45, lines 10-29; col. 53, line 
32-coL 54, line 18; and col. 21, line 15-col. 22, line 13. Nowhere in these cites are disclosed the 



steps of claim 3 and claim 6. Furthermore, the cites include steps not found in claim 6 (i.e., attach 
a confidence factor to each of the plurality of geographic locations; selecting an estimated 
geographic location as being a best estimate of a true geographic location of the network address 
based on a degree of confidence-factor weighted agreement; using a Last Known Host, a Next 
Known Host, a combination of a Next Known Host and a Last Known Host, or at least one suffix 
of a host name to generate a geographic location; using a confidence map, a hop ratio, a string 
length, a number of geographic locations generated by the at least one geographic location / 
operation, a population value, a distance to a Last Known Host, a number of hops between a Last 
Known Host and the at least one geographic location, a minimum population of the at least one 
geographic location and a Last Known Host, a minimum connectivity index of the at least one 
geographic location and a Last Known Host, a distance to a Next Known Host from the at least 
one geographic location, a hop ratio indicating a relative position of a Next Known Host within a 
traceroute against the network address, a distance between a Next Known Host and the at least 
one geographic location, a number of hops between a Next Known Host and the at least one 
geographic location within a traceroute against the network address, a minimum population of a 
Next Known Host and the at least one geographic location, a minimum connectivity index 
between the at least one geographic location and a Next Known Host, a mean of connectivity 
indices for a Last Known Host and address, a position of a first character of a word indicative of 
the at least one geographic location within a host name, or a number of network addresses within 
a registered block of network addresses; using a divide-and-conquer blocking algorithm; 
identifying a common geographic location associated with each of the subject and the test 
network addresses; identifying a substantially common traceroute generated responsive to 
traceroute operations performed against each of the subject and test network addresses; 



determining whether the subject and test network addresses utilizing a common DNS server; 
using a netmask blocking algorithm that utilizes a netmask associated with a subject network 
address; using a topology map; and using respective start and end network addresses; using a 
location synthesis process to search for similarities among location determinants and building a 
confirmation table; building location probability table (LPT); developing different values at 
different levels of geographic resolution; combining constituent confidence factor fields to 
identify a most likely location and an associated probability; computing the relationship between 
post-LSP confidence factors and accuracy; translating the location probability table to reflect the 
actual probability that the given network address was correctly located; using location 
determination modules (LDMs), confidence maps (CMs), confidence factors (CFs); using a 
location filter 122; using nine location determination modules, RegEx LDM 130 that uses string 
pattern matching in a hostname, Net LDM 132 that uses an IP Registry, DNS LDM 134 that uses 
a Domain Name Service Registry, ASN LDM 136 that uses an Autonomous System Registry, 
Loc LDM 138 that uses a DNS Loc Record, LKH LDM 140 that uses a Last Known Host in a 
Traceroute, NKH LDM 142 that uses a Next Known Host in a Traceroute, Sandwich LDM 144 
that uses a combination of LKH and NKH, Suffix LDM 146 that uses the last one or two words 
of a hostname; using triangulation; extrapolating a general direction from the traceroutes; 
inferring direction by subtracting geographical locations of the originating network address from 
those of the latest router in the trace; using the number of hops to estimate distance; making 
"rsh" calls to obtain traceroutes; and generating a resolution indication using direction, number 
of traces, and variances in distances; rendering geolocation information for neighboring network 
addresses within a block to increase the confidence factor; writing a record into a data 
warehouse; executing a series of inexact geographic location operations; labeling inexact 



geographic location operations as such; executing inexact geolocation operations on a number of 
network addresses surrounding a subject network address; consolidating the outputs of the 
inexact geolocation operations by a unified mapping process; forwarding negative determinations 
for manual resolution; examining next-to-last hop in traceroute; looking one hop back; start 
looking for hosts at the high end; using a divide-and-conquer method of selective pinging; 
determining whether an end node traceroute is the same as the next-to-last hop traceroute; and 
looking for patterns in the last three hops). 

Examiner said that claim 7 (where some steps of claim 3 are repeated until a distance is 
within a user-definable threshold) was disclosed in Anderson in the Abstract, col. 4, line 23-col. 
5, line 50; col.17, line 42-col. 18, line 18; col. 25, lines 1-67; col. 45, lines 10-29; col. 53, line 
32-coL 54, line 18; and col. 21, line 15-col. 22, line 13. Nowhere in these cites are disclosed the 
steps of claim 3 and claim 7. Furthermore, the cites include steps not found in claim 7 (i.e., attach 
a confidence factor to each of the plurality of geographic locations; selecting an estimated 
geographic location as being a best estimate of a true geographic location of the network address 
based on a degree of confidence-factor weighted agreement; using a Last Known Host, a Next 
Known Host, a combination of a Next Known Host and a Last Known Host, or at least one suffix 
of a host name to generate a geographic location; using a confidence map, a hop ratio, a string 
length, a number of geographic locations generated by the at least one geographic location 
operation, a population value, a distance to a Last Known Host, a number of hops between a Last 
Known Host and the at least one geographic location, a minimum population of the at least one 
geographic location and a Last Known Host, a minimum connectivity index of the at least one 
geographic location and a Last Known Host, a distance to a Next Known Host from the at least 
one geographic location, a hop ratio indicating a relative position of a Next Known Host within a 



traceroute against the network address, a distance between a Next Known Host and the at least 
one geographic location, a number of hops between a Next Known Host and the at least one 
geographic location within a traceroute against the network address, a minimum population of a 
Next Known Host and the at least one geographic location, a minimum connectivity index 
between the at least one geographic location and a Next Known Host, a mean of connectivity 
indices for a Last Known Host and address, a position of a first character of a word indicative of 
the at least one geographic location within a host name, or a number of network addresses within 
a registered block of network addresses; using a divide-and-conquer blocking algorithm; 
identifying a common geographic location associated with each of the subject and the test 
network addresses; identifying a substantially common traceroute generated responsive to 
traceroute operations performed against each of the subject and test network addresses; 
determining whether the subject and test network addresses utilizing a common DNS server; 
using a netmask blocking algorithm that utilizes a netmask associated with a subject network 
address; using a topology map; and using respective start and end network addresses; using a 
location synthesis process to search for similarities among location determinants and building a 
confirmation table; building location probability table (LPT); developing different values at 
different levels of geographic resolution; combining constituent confidence factor fields to 
identify a most likely location and an associated probability; computing the relationship between 
post-LSP. confidence factors and accuracy; translating the location probability table to reflect the 
actual probability that the given network address was correctly located; using location 
determination modules (LDMs), confidence maps (CMs), confidence factors (CFs); using a 
location filter 122; using nine location determination modules, RegEx LDM 130 that uses string 
pattern matching in a hostname, Net LDM 132 that uses an IP Registry, DNS LDM 134 that uses 



a Domain Name Service Registry, ASN LDM 136 that uses an Autonomous System Registry, 
Loc LDM 138 that uses a DNS Loc Record, LKH LDM 140 that uses a Last Known Host in a 
Traceroute, NKH LDM 142 that uses a Next Known Host in a Traceroute, Sandwich LDM 144 
that uses a combination of LKH and NKH, Suffix LDM 146 that uses the last one or two words 
of a hostname; using triangulation; extrapolating a general direction from the traceroutes; 
inferring direction by subtracting geographical locations of the originating network address from 
those of the latest router in the trace; using the number of hops to estimate distance; making 
"rsh" calls to obtain traceroutes; and generating a resolution indication using direction, number 
of traces, and variances in distances; rendering geolocation information for neighboring network 
addresses within a block to increase the confidence factor; writing a record into a data 
warehouse; executing a series of inexact geographic location operations; labeling inexact 
geographic location operations as such; executing inexact geolocation operations on a number of 
network addresses surrounding a subject network address; consolidating the outputs of the 
inexact geolocation operations by a unified mapping process; forwarding negative determinations 
for manual resolution; examining next-to-last hop in traceroute; looking one hop back; start 
looking for hosts at the high end; using a divide-and-conquer method of selective pinging; 
determining whether an end node traceroute is the same as the next-to-last hop traceroute; and 
looking for patterns in the last three hops). 

Examiner said that claim 8 (where the calibration period of claim 1 extends to all 
previous measuring of said network) was disclosed in Anderson in the Abstract, col. 4, line 23- 
col. 5, line 50; col. 17, line 42-col. 18, line 18; col. 25, lines 1-67; col. 45, lines 10-29; col. 53, 
line 32-col. 54, line 18; and col. 21, line 15-col. 22, line 13. Nowhere in these cites are disclosed 
the steps of claim 1 and claim 8. Furthermore, the cites include steps not found in claim 8 (i.e., 



attach a confidence factor to each of the plurality of geographic locations; selecting an estimated 
geographic location as being a best estimate of a true geographic location of the network address 
based on a degree of confidence-factor weighted agreement; using a Last Known Host, a Next 
Known Host, a combination of a Next Known Host and a Last Known Host, or at least one suffix 
of a host name to generate a geographic location; using a confidence map, a hop ratio, a string 
length, a number of geographic locations generated by the at least one geographic location 
operation, a population value, a distance to a Last Known Host, a number of hops between a Last 
Known Host and the at least one geographic location, a minimum population of the at least one 
geographic location and a Last Known Host, a minimum connectivity index of the at least one 
geographic location and a Last Known Host, a distance to a Next Known Host from the at least 
one geographic location, a hop ratio indicating a relative position of a Next Known Host within a 
traceroute against the network address, a distance between a Next Known Host and the at least 
one geographic location, a number of hops between a Next Known Host and the at least one 
geographic location within a traceroute against the network address, a minimum population of a 
Next Known Host and the at least one geographic location, a minimum connectivity index 
between the at least one. geographic location and a Next Known Host, a mean of connectivity 
indices for a Last Known Host and address, a position of a first character of a word indicative of 
the at least one geographic location within a host name, or a number of network addresses within 
a registered block of network addresses; using a divide-and-conquer blocking algorithm; 
identifying a common geographic location associated with each of the subject and the test 
network addresses; identifying a substantially common traceroute generated responsive to 
traceroute operations performed against each of the subject and test network addresses; 
determining whether the subject and test network addresses utilizing a common DNS server; 



using a netmask blocking algorithm that utilizes a netmask associated with a subject network 
address; using a topology map; and using respective start and end network addresses; using a 
location synthesis process to search for similarities among location determinants and building a 
confirmation table; building location probability table (LPT); developing different values at 
different levels of geographic resolution; combining constituent confidence factor fields to 
identify a most likely location and an associated probability; computing the relationship between 
post-LSP confidence factors and accuracy; translating the location probability table to reflect the 
actual probability that the given network address was correctly located; using location 
determination modules (LDMs), confidence maps (CMs), confidence factors (CFs); using a 
location filter 122; using nine location determination modules, RegEx LDM 130 that uses string 
pattern matching in a hostname, Net LDM 132 that uses an IP Registry, DNS LDM 134 that uses 
a Domain Name Service Registry, ASN LDM 136 that uses an Autonomous System Registry, 
Loc LDM 138 that uses a DNS Loc Record, LKH LDM 140 that uses a Last Known Host in a 
Traceroute, NKH LDM 142 that uses a Next Known Host in a Traceroute, Sandwich LDM 144 
that uses a combination of LKH and NKH, Suffix LDM 146 that uses the last one or two words 
of a hostname; using triangulation; extrapolating a general direction from the traceroutes; 
inferring direction by subtracting geographical locations of the originating network address from 
those of the latest router in the trace; using the number of hops to estimate distance; making 
"rsh" calls to obtain traceroutes; and generating a resolution indication using direction, number 
of traces, and variances in distances; rendering geolocation information for neighboring network 
addresses within a block to increase the confidence factor; writing a record into a data 
warehouse; executing a series of inexact geographic location operations; labeling inexact 
geographic location operations as such; executing inexact geolocation operations on a number of 



network addresses surrounding a subject network address; consolidating the outputs of the 
inexact geolocation operations by a unified mapping process; forwarding negative determinations 
for manual resolution; examining next-to-last hop in traceroute; looking one hop back; start 
looking for hosts at the high end; using a divide-and-conquer method of selective pinging; 
determining whether an end node traceroute is the same as the next-to-last hop traceroute; and 
looking for patterns in the last three hops). 

Examiner said that claim 9 (the method of claim 1 where the calibration period extends 
back a user-defined period of time) was disclosed in Anderson in the Abstract, col. 4, line 23-col. 
5, line 50; col.17, line 42-col. 18, line 18; col. 25, lines 1-67; col. 45, lines 10-29; and col. 53, 
line 32-col. 54, line 18. Nowhere in these cites are disclosed the steps of claim 1 and claim 9. 
Furthermore, the cites include steps not found in claim 9 (i.e., attach a confidence factor to each . 
of the plurality of geographic locations; selecting an estimated geographic location as being a 
best estimate of a true geographic location of the network address based on a degree of 
confidence- factor weighted agreement; using a Last Known Host, a Next Known Host, a 
combination of a Next Known Host and a Last Known Host, or at least one suffix of a host name 
to generate a geographic location; using a confidence map, a hop ratio, a string length, a number 
of geographic locations generated by the at least one geographic location operation, a population 
value, a distance to a Last Known Host, a number of hops between a Last Known Host and the at 
least one geographic location, a minimum population of the at least one geographic location and 
a Last Known Host, a minimum connectivity index of the at least one geographic location and a 
Last Known Host, a distance to a Next Known Host from the at least one geographic location, a 
hop ratio indicating a relative position of a Next Known Host within a traceroute against the 
network address, a distance between a Next Known Host and the at least one geographic 



location, a number of hops between a Next Known Host and the at least one geographic location 
within a traceroute against the network address, a minimum population of a Next Known Host 
and the at least one geographic location, a minimum connectivity index between the at least one 
geographic location and a Next Known Host, a mean of connectivity indices for a Last Known 
Host and address, a position of a first character of a word indicative of the at least one geographic 
location within a host name, or a number of network addresses within a registered block of 
network addresses; using a divide-and-conquer blocking algorithm; identifying a common 
geographic location associated with each of the subject and the test network addresses; 
identifying a substantially common traceroute generated responsive to traceroute operations 
performed against each of the subject and test network addresses; determining whether the 
subject and test network addresses utilizing a common DNS server; using a netmask blocking 
algorithm that utilizes a netmask associated with a subject network address; using a topology 
map; and using respective start and end network addresses; using a location synthesis process to 
search for similarities among location determinants and building a confirmation table; building 
location probability table (LPT); developing different values at different levels of geographic 
resolution; combining constituent confidence factor fields to identify a most likely location and 
an associated probability; computing the relationship between post-LSP confidence factors and 
accuracy; translating the location probability table to reflect the actual probability that the given 
network address was correctly located; using location determination modules (LDMs), 
confidence maps (CMs), confidence factors (CFs); using a location filter 122; using nine location 
determination modules, RegEx LDM 130 that uses string pattern matchingan a hostname, Net 
LDM 132 that uses an IP Registry, DNS LDM 134 that uses a Domain Name Service Registry, 
ASN LDM 136 that uses an Autonomous System Registry, Loc LDM 138 that uses a DNS Loc 



Record, LKH LDM 140 that uses a Last Known Host in a Traceroute, NKH LDM 142 that uses a 
Next Known Host in a Traceroute, Sandwich LDM 144 that uses a combination of LKH and 
NKH, Suffix LDM 146 that uses the last one or two words of a hostname; using triangulation; 
extrapolating a general direction from the traceroutes; inferring direction by subtracting 
geographical locations of the originating network address from those of the latest router in the 
trace; using the number of hops to estimate distance; making "rsh" calls to obtain traceroutes; 
generating a resolution indication using direction, number of traces, and variances in distances; 
rendering geolocation information for neighboring network addresses within a block to increase 
the confidence factor; writing a record into a data warehouse; executing a series of inexact 
geographic location operations; labeling inexact geographic location operations as such; 
executing inexact geolocation operations on a number of network addresses surrounding a 
subject network address; consolidating the outputs of the inexact geolocation operations by a 
unified mapping process; forwarding negative determinations for manual resolution; examining 
next-to-last hop in traceroute; looking one hop back; start looking for hosts at the high end; using 
a divide-and-conquer method of selective pinging; determining whether an end node traceroute is 
the same as the next-to-last hop traceroute; and looking for patterns in the last three hops). 

Examiner said that claim 10 (the method of claim 1 where the communication is the) was 
disclosed in Anderson in col. 21, line 15-col. 22, line 13. Nowhere in this cite is disclosed the 
steps of claim 1 and claim 10. Furthermore, this cites include steps not found in claim 10 (i.e., 
start looking for hosts at the high end; using a divide-and-conquer method of selective pinging; 
determining whether an end node traceroute is the same as the next-to-last hop traceroute; and 
looking for patterns in the last three hops). 



Examiner said that claim 1 1 (the method of claim 1 where some steps are performed 
based on user-definable external factors) was disclosed in Anderson in the Abstract, col. 4, line 
23-col. 5, line 50; col.17, line 42-col. 18, line 18; col. 25, lines 1-67; col. 45, lines 10-29; and col. 
53, line 32-col. 54, line 18. Nowhere in these cites are disclosed the steps of claim 1 and claim 
1 1 . Furthermore, the cites include steps not found in claim 1 1 (i.e., attach a confidence factor to 
each of the plurality of geographic locations; selecting an estimated geographic location as being 
a best estimate of a true geographic location of the network address based on a degree of 
confidence-factor weighted agreement; using a Last Known Host, a Next Known Host, a 
combination of a Next Known Host and a Last Known Host, or at least one suffix of a host name 
to generate a geographic location; using a confidence map, a hop ratio, a string length, a number 
of geographic locations generated by the at least one geographic location operation, a population 
value, a distance to a Last Known Host, a number of hops between a Last Known Host and the at 
least one geographic location, a minimum population of the at least one geographic location and 
a Last Known Host, a minimum connectivity index of the at least one geographic location and a 
Last Known Host, a distance to a Next Known Host from the at least one geographic location, a 
hop ratio indicating a relative position of a Next Known Host within a traceroute against the 
network address, a distance between a Next Known Host and the at least one geographic 
location, a number of hops between a Next Known Host and the at least one geographic location 
within a traceroute against the network address, a minimum population of a Next Known Host 
and the at least one geographic location, a minimum connectivity index between the at least one 
geographic location and a Next Known Host, a mean of connectivity indices for a Last Known 
Host and address, a position of a first character of a word indicative of the at least one geographic 
location within a host name, or a number of network addresses within a registered block of 



network addresses; using a divide-and-conquer blocking algorithm; identifying a common 
geographic location associated with each of the subject and the test network addresses; 
identifying a substantially common traceroute generated responsive to traceroute operations 
performed against each of the subject and test network addresses; determining whether the 
subject and test network addresses utilizing a common DNS server; using a netmask blocking 
algorithm that utilizes a netmask associated with a subject network address; using a topology 
map; and using respective start and end network addresses; using a location synthesis process to 
search for similarities among location determinants and building a confirmation table; building 
location probability table (LPT); developing different values at different levels of geographic 
resolution; combining constituent confidence factor fields to identify a most likely location and 
an associated probability; computing the relationship between post-LSP confidence factors and 
accuracy; translating the location probability table to reflect the actual probability that the given 
network address was correctly located; using location determination modules (LDMs), 
confidence maps (CMs), confidence factors (CFs); using a location filter 122; using nine location 
determination modules, RegEx LDM 130 that uses string pattern matching in a hostname, Net 
LDM 132 that uses an IP Registry, DNS LDM 134 that uses a Domain Name Service Registry, 
ASN LDM 136 that uses an Autonomous System Registry, Loc LDM 138 that uses a DNS Loc 
Record, LKH LDM 140 that uses a Last Known Host in a Traceroute, NKH LDM 142 that uses a 
Next Known Host in a Traceroute, Sandwich LDM 144 that uses a combination of LKH and 
NKH, Suffix LDM 146 that uses the last one or two words of a hostname; using triangulation; 
extrapolating a general direction from the traceroutes; inferring direction by subtracting 
geographical locations of the originating network address from those of the latest router in the 
trace; using the number of hops to estimate distance; making "rsh" calls to obtain traceroutes; 



generating a resolution indication using direction, number of traces, and variances in distances; 
rendering geolocation information for neighboring network addresses within a block to increase 
the confidence factor; writing a record into a data warehouse; executing a series of inexact 
geographic location operations; labeling inexact geographic location operations as such; 
executing inexact geolocation operations on a number of network addresses surrounding a 
subject network address; consolidating the outputs of the inexact geolocation operations by a 
unified mapping process; forwarding negative determinations for manual resolution; examining 
next-to-last hop in traceroute; looking one hop back; start looking for hosts at the high end; using 
a divide-and-conquer method of selective pinging; determining whether an end node traceroute is 
the same as the next-to-last hop traceroute; and looking for patterns in the last three hops). 

Reconsideration of the application in light of the remarks is requested. Allowance of 
claims 1-11 is solicited. 



Respectfully submitted. 
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